Jev and other decision models can still be tricked with prompt injection
Never making type errors does not mean never making errors
Despite claims that decision models like Jev from TypeSafe AI cannot hallucinate or make type errors, these models are still susceptible to manipulation through indirect prompt injection. Unlike traditional large language models (LLMs) that generate arbitrary text, decision models output a set of probabilities and a confidence score.
However, they are fundamentally LLMs, using a different decoding strategy. Security firm HiddenLayer recently tested Jev and a traditional LLM, Qwen3.8-27B, to assess their resistance to manipulation. The researchers discovered that both models could be tricked using a technique called prompt injection. By adding a deceptive button to a simulated online store page, the system was tricked into clicking the button instead of completing the pre-programmed instructions.
This vulnerability affected both Jev and Qwen, with Jev being slightly less prone to this kind of attack. The researchers also found that attackers could bypass the model's built-in prompt verification system by using a variant of the tokenbreak attack, which involves adding extra letters to a prompt to evade classifiers. This suggests that a model's ability to return a decision does not negate its underlying LLM nature; the decision ultimately becomes an action in the system. TypeSafe AI has not commented on these findings.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
